diff --git a/nixops/backends/__init__.py b/nixops/backends/__init__.py
index 4428de77..127107b1 100644
--- a/nixops/backends/__init__.py
+++ b/nixops/backends/__init__.py
@@ -8,6 +8,14 @@ import nixops.util
 import nixops.resources
 import nixops.ssh_util

+class KeyOptions(nixops.resources.ResourceOptions):
+    text: Optional[str]
+    keyFile: Optional[str]
+    destDir: str
+    user: str
+    group: str
+    permissions: str
+    fizz: str

 class MachineOptions(nixops.resources.ResourceOptions):
     storeKeysOnMachine: bool
@@ -15,7 +23,7 @@ class MachineOptions(nixops.resources.ResourceOptions):
     alwaysActivate: bool
     owners: Sequence[str]
     hasFastConnection: bool
-    keys: Mapping[str, Mapping]
+    keys: Mapping[str, KeyOptions]
     nixosRelease: str


@@ -29,7 +37,7 @@ class MachineDefinition(nixops.resources.ResourceDefinition):
     always_activate: bool
     owners: List[str]
     has_fast_connection: bool
-    keys: Mapping[str, Mapping]
+    keys: Mapping[str, KeyOptions]

     def __init__(self, name: str, config: nixops.resources.ResourceEval):
         super().__init__(name, config)
@@ -38,7 +46,8 @@ class MachineDefinition(nixops.resources.ResourceDefinition):
         self.always_activate = config["alwaysActivate"]
         self.owners = config["owners"]
         self.has_fast_connection = config["hasFastConnection"]
-        self.keys = config["keys"]
+        self.keys = {k: KeyOptions(**v) for k,v in config["keys"].items()}
+


 class MachineState(nixops.resources.ResourceState):
@@ -255,13 +264,14 @@ class MachineState(nixops.resources.ResourceState):
             return
         if self.store_keys_on_machine:
             return
+        opts: KeyOptions
         for k, opts in self.get_keys().items():
+            from pprint import pprint
+            pprint(opts)
             self.log("uploading key ‘{0}’...".format(k))
             tmp = self.depl.tempdir + "/key-" + self.name
-            if "destDir" not in opts:
-                raise Exception("Key '{}' has no 'destDir' specified.".format(k))

-            destDir = opts["destDir"].rstrip("/")
+            destDir = opts.destDir.rstrip("/")
             self.run_command(
                 (
                     "test -d '{0}' || ("
@@ -270,11 +280,11 @@ class MachineState(nixops.resources.ResourceState):
                 ).format(destDir)
             )

-            if "text" in opts:
+            if opts.text is not None:
                 with open(tmp, "w+") as f:
-                    f.write(opts["text"])
-            elif "keyFile" in opts:
-                self._logged_exec(["cp", opts["keyFile"], tmp])
+                    f.write(opts.text)
+            elif opts.keyFile is not None:
+                self._logged_exec(["cp", opts.keyFile, tmp])
             else:
                 raise Exception(
                     "Neither 'text' or 'keyFile' options were set for key '{0}'.".format(
@@ -306,7 +316,7 @@ class MachineState(nixops.resources.ResourceState):
                         "chmod '{3}' {0}",
                     ]
                 ).format(
-                    tmp_outfile_esc, opts["user"], opts["group"], opts["permissions"]
+                    tmp_outfile_esc, opts.user, opts.group, opts.permissions
                 )
             )
             self.run_command("mv " + tmp_outfile_esc + " " + outfile_esc)